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ABSTRACT 



The Office of the State Comptroller in New York audited the 
City University of New York's (CUNY) Year 2000 compliance efforts for the 
period of April 1, 1996 through March 31, 1998. The purpose of the audit was 

to determine whether CUNY's efforts provided reasonable assurance that 
computer processing will continue without interruption or inaccuracy after 
the turn of the century. Findings showed that CUNY's establishment of a Year 
2000 Task Force at the agency level occurred much later than government and 
computing industry leaders indicated would be appropriate if all risks were 
to be addressed in a timely manner. Specifically, it was concluded that 
CUNY's efforts to date do not reasonably assure that instructional and 
administrative functions performed on college-level computer systems and 
thousands of personal computers throughout CUNY and its colleges will 
continue to operate and produce correct results after 2000. CUNY needs to 
consider the development of contingency plans or other alternative solutions 
if important systems fail or are not expected to be compliant on time. (AS) 
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Acting Chancellor 
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535 East 80* Street 
New York, New York 10021 



Re: Actions to Address the 
Year 2000 Challenge 
Report 97-N-13 



Dear Dr. Kimmich: 

Pursuant to the State Comptroller’s authority as set forth in Article V, Section 1 of the State 
Constitution and Article 2, Section 8 of the State Finance Law, we have audited the City University 
of New York (CUNY) Year 2000 compliance efforts for the period of April 1, 1996 through March 
31, 1998. 

A. Background 
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A major challenge facing government organizations today is the need to prepare their computer 
systems to handle dates beyond December 31, 1999 - otherwise known as the Year 2000 problem. 
Until recently, most computer programs were designed to use two digits to designate the year, and 
therefore cannot determine the century. For example, a computer in the year 2000 might calculate that 
a person born in 1997 is 97 years old, rather than 3 years old. Left uncorrected, fundamental 
operations on computer systems will fail or produce incorrect results. 

The problem is imposing as it encompasses all computer hardware from mainframes to 
personal computers (PCs) and all computerized programs and processes, including those developed by 
vendors, programming staff, and end-users. Ancillary equipment such as elevators and telephone- 
switching devices may also be subject to interruptions if a microprocessor or embedded computer code 
that is not Year 2000-compliant controls its functions. Moreover, the amount of time available to 
correct this problem is limited, because some systems must process Year 2000 dates well before 
December 31, 1999. 
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Faced with the risk that systems may not become Year 2000-compliant in a timely manner, 
management must ensure that the resources it devotes to correcting the problem are applied to the most 
important systems. Contingency plans must also be established to ensure provision of important 
services and functions in the event that systems fail because of noncompliance with Year 2000 
requirements 

CUNY is the largest urban university in the United States, and is the third-largest public 
university system. Some 200,000 students are enrolled in degree programs on 21 campuses in all 5 
boroughs of New York City. Another 150,000 CUNY students take adult and continuing education 
courses. 

CUNY operates two major data centers, Computer Information Services (CIS) in Manhattan 
and the University Application Processing Center (UAPC) in Brooklyn. Each of these centers operates 
independently, with its own mainframe computer, and supports CUNY’s critical centralized 
information systems. The systems maintained at these centers include the Student Information 
Management System (SIMS), the Personnel System, the Library System and the Student Automated 
Record Keeping System (SARK). SARK is operated under contract for the New York City Board of 
Education. Systems supporting the Financial Aid, Tuition Assistance, Direct Loan, and Pell Grant 
programs are also processed on the mainframe computer. 

The University Accounting Office (UAO) independently maintains its own CIS mainframe 
applications to support financial, budget, student aid, and inventory needs. Each CUNY college 
maintains educational systems and depends on a variety of PCs as well as ancillary equipment that use 
embedded computer code or microprocessors. A few CUNY colleges have their own mainframe 
computer, and two of them maintain their own Student Information Management System. 

The scope of the CUNY computing environment and the importance of this environment to the 
functioning of the college educational system in New York City requires a well-planned and well- 
executed approach to the Year 2000 problem. We believe that CUNY needs to have the following 
essential elements of control if it is to succeed: 

• top management involvement to raise awareness about the problem and to define the 
policy and organizational approach for correcting the problem; 

• development of an inventory of systems that need to be corrected; 

• establishment of the timeframes and resource requirements for correction efforts; 

• creation of a command and control organizational structure to manage and accomplish 
correction of the problem; and 

• establishment of procedures for the examination, modification, and testing of 
noncompliant systems and the implementation of corrected systems. 
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These elements of control are consistent with those recommended for large organizations by 
the United States General Accounting Office and the Gartner Group, a leading information technology 
consulting organization. 

CUNY began to examine the Year 2000 issue as an agency-wide project in the fall of 1997 
when the Vice Chancellor for Budget, Finance and Information Services began holding discussions 
about the issue with central office units. CUNY’s two data centers, CIS and UAPC, and UAO had 
already initiated their own independent Year 2000 projects for the agency’s major Centralized systems. 
Efforts to raise awareness agency-wide were also initiated in the fall of 1997 at monthly Administrative 
Council meetings attended by central office administrators and managers as well as the colleges’ vice 
presidents. 

In December 1997, the Vice Chancellor initiated an inter-office Year 2000 Task Force (Task 
Force) headed by the Director of Campus Services, that was to assemble materials that would help 
central offices and colleges manage the tasks of assessing the Year 2000-compliance status of their 
systems and implementing the required changes. The Vice Chancellor asked each central office unit 
to assign an individual to serve on the Task Force. College presidents were asked to identify a staff 
member who would serve as point of contact for the Task Force. All of these individuals were to be 
responsible for overseeing or coordinating Year 2000 activity within their offices or colleges. The 
Task Force acts as a facilitator for the central offices and colleges, but has no authority or 
responsibility for implementing the agency-wide project. Each central office and college remains 
ultimately responsible for correcting its own systems. At a post-field work meeting, CUNY officials 
advised us that the Task Force first met on April 29, 1998, and asked each college to establish a 
committee to develop a corrective action plan and an application inventory within four weeks. 

B. Audit Scope. Objective, and Methodology 

The scope of our performance audit includes CUNY’s agency-wide efforts to achieve Year 
2000-compliance for its computer systems. Our objective is to determine whether CUNY’s efforts 
provide reasonable assurances that important computer processing will continue without material 
interruptions or inaccuracies caused by the Year 2000 problem. To accomplish this objective, we 
reviewed and evaluated the adequacy of CUNY’s actions during the period of April 1, 1996 through 
March 31, 1998, to solve the problem. In conducting our audit, we used guidelines and criteria 
developed by both the Gartner Group and the United States Government Accounting Office (GAO). 

We conducted our audit in accordance with generally accepted government auditing standards. 
Such standards require that we plan and perform our audit to adequately assess those operations which 
are included in our audit scope. Further, these standards require that we understand CUNY’s internal 
control structure and its compliance with those laws, rules and regulations that are relevant to the 
operations which are included in our audit scope. An audit includes examining, on a test basis, 
evidence supporting transactions reported in the accounting and operating records and applying such 
other auditing procedures as we consider necessary in the circumstances. An audit also includes 
assessing the estimates, judgments and decisions made by management. We believe that our audit 
provides a reasonable basis for our findings, conclusions and recommendations. 
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We use a risk-based approach to select activities for audit. Therefore, we focus our audit 
efforts on those activities we have identified through a preliminary survey as having the greatest 
probability for improvement. Consequently, by design, we use finite audit resources to identify where 
and how improvements can be made. We devote little audit effort to reviewing operations that may 
be relatively efficient or effective. As a result, we prepare our reports on an “exception basis.” This 
report, therefore, highlights those areas needing improvement and does not address activities that may 
be functioning properly. 

C. Results of Audit 

CUNY's establishment of a Year 2000 Task Force at the agency level occurred much later than 
government and computing indusby leaders have indicated would be appropriate if all Year 2000 risks 
were to be addressed in a timely manner. We are concerned that the late start and the decentralized 
nature of its efforts may leave certain functions at risk. Officials at all levels throughout CUNY will 
need to work together to meet this challenge. 

Specifically, we have concluded that CUNY’s efforts to date do not reasonably assure that 
instructional and administrative functions performed on college-level computer systems and thousands 
of PCs throughout CUNY and its colleges will continue to operate and to produce correct results as 
the Year 2000 approaches. In addition, we concluded that CUNY’s efforts provide insufficient 
assurance that the use of ancillary equipment that has noncompliant computer code will not have a 
significant impact on the operation of CUNY facilities. 

Each of three major units with central mainframe applications has made substantive independent 
efforts to prepare for the Year 2000. The continuance of these efforts, as well as attention to certain 
weaknesses that we identified during our examination should help to ensure the timely correction of 
mainframe computer applications at CIS, UAPC, and UAO that are mission-critical. Time is of the 
essence, and continued oversight is necessary. 

CUNY needs to consider the development of contingency plans or other alternative solutions 
that may be pursued if important systems fail or are not expected to be compliant on time. Some 
systems may need to be compliant before January 1 , 2000. 

1. Project Management 

The accomplishment of an agency-wide Year 2000 initiative can be best assured when top 
management prepares and issues a timely policy directive and program charter that formalizes it and 
makes it possible to broadcast support for resolution of the problem. In addition, with large-scale 
organizations such as CUNY’s, the agency usually establishes a Year 2000 program office responsible 
for overseeing progress, approving plans, establishing priorities and budgets, and controlling necessary 
resources. It is also necessary to launch an effective Year 2000 awareness program designed to alert 
all affected parties to the challenge and to help in the exchange of information and knowledge that is 
needed to achieve a timely and complete resolution of the problem. 
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Until the Task Force was initiated in December 1997, CUNY had not issued an executive- level 
Year 2000 directive. Considering the scope of CUNY’s organization and its extensive reliance on 
information technology resources, we believe such a directive should have taken place much sooner 
to reduce the risk of untimely corrections and any resultant service disruptions. CUNY’s agency-wide 
Year 2000 project does not call for a specific program office to control the effort. Instead, it relies on 
the Task Force to facilitate the individual efforts of various central office units and college committees. 
CUNY maintains that this approach is more suited to its overall organization structure. We reiterate 
our concern, which is consistent with opinions of Year 2000 problem experts, that solving the problem 
in large organizations requires a command-and-control structure and operating philosophy. We believe 
that CUNY needs to be prepared to follow a more control-oriented policy if this facilitative approach 
does not make sufficient progress. 

We noted during our field work that CUNY did not have an agency-wide cost estimate or 
budget for its Year 2000 project, lacked a comprehensive plan for supporting it, had not completed 
a comprehensive system inventory as a basis for assessing relative risk exposure for noncompliant 
systems, and had not involved its legal department in assessing the potential for lawsuits if services 
are interrupted because its computer systems are noncompliant. During our post-field work meeting 
with CUNY officials on June 11, 1998, officials indicated that they had made progress with the 
management of their agency-wide project. They informed us that a preliminary compliance inventory 
had been initiated for mainframe peripherals, telecommunications equipment, modems, PC servers, 
desktop PCs, and mainframe software. They also indicated that a testing plan for minicomputer and 
PC computer equipment was available and that CUNY’s Legal Affairs office was represented on the 
Task Force. The Vice Chancellor informed us that he expects the colleges to have completed a system 
inventory and prepared a related Year 2000 assessment by the fall of 1998, and that a Year 2000 
budget will be available for the 1998-99 fiscal year. 

We also found that CUNY's initial efforts to raise awareness had been targeted at high-level 
officials, and did not address other staff. CUNY officials have subsequently indicated that they are 
now implementing an effective awareness program throughout the agency. For example, the CIS 
Spring 1998 electronic information newsletter was devoted primarily to explaining the Year 2000 
problem and CUNY efforts to address it; the Task Force asked the college presidents to communicate 
with their employees about the problem; and CUNY's Internet website was being used to disseminate 
Year 2000 problem information throughout the organization and obtain feedback. 

2. Project Status 

CUNY management has been making consistent progress in correcting Year 2000 problems 
at the CIS and UAPC data centers. In addition, the UAO has identified Year 2000 problem areas and 
has made plans to correct these in the near future. However, CUNY’s colleges appear less 
knowledgeable about the issue, and in need of direction and monitoring. 

• CIS Data Center 

The CIS Director of Communications is responsible for central office computer 
operations and all hardware, including ancillary equipment. CIS has developed an inventory of central 
office mainframe equipment and software, PCs, and teleprocessing equipment. For these items, letters 



O 

ERIC 



7 



- 6 - 



have been sent to the appropriate vendors seeking written certifications for Year 2000 compliance. 
CIS has been evaluating software that would help test PCs for Year 2000 compliance, and has installed 
Year 2000-compliant versions of its Student Information Management System, City University 
Personnel System, and vendor-supplied Library System - all of which are centralized application 
systems used by most of the colleges. After our field work was completed, CIS provided us with a 
May 19, 1998, memorandum from the University Chief Engineer to all Vice Presidents /Deans of 
Administration requesting their help in identifying all embedded systems throughout the University so 
that equipment manufacturers can be contacted as soon as possible to determine the Year 2000- 
compliance status of the embedded systems. 

Despite this progress, CIS has neither established an overall work plan for its Year 
2000- compliance efforts nor has it completed a formal inventory of all of its applications. These steps 
would help ensure a complete assessment of Year 2000 risks as a basis for setting priorities, allocating 
resources, and establishing workplans. In addition, CIS has not utilized any specific written policies 
and procedures that should be followed to assure the full testing of affected systems for Year 2000- 
compliance. These weaknesses increase the risk that remaining Year 2000- related problems will not 
be corrected in time. 

CIS officials advised us that full systems testing is expected to take place after its new 
mainframe computer is installed in the fall of 1998. They said they expect this testing to be completed 
by December 1998, thus allowing CIS one full year to debug any problems. To complete their testing 
objectives in the desired timeframe, we believe that officials need to address the weaknesses we noted. 
In addition, CIS may not have a full year to ensure compliance for all affected systems if the time 
horizon to failure for any of those systems occurs before December 31, 1999. In the absence of a 
complete systems inventory and related risk assessment, it is uncertain whether and to what extent CIS 
systems are at risk before Year 2000. 

Response of CIS Officials to Audit : In response to our report, CIS officials state that Task Force 
meetings continue, testing procedures have been provided and several inventories have been 
completed. 



• University Accounting Office 

The University Accounting Office (UAO) systems are processed at the CIS data center. 
UAO’s Information Systems Group, which is responsible for the maintenance of these applications, 
has identified the ones in critical need of correction: Financial, Budget, Student Financial Aid, and 
Fixed Asset Inventory systems. UAO officials advised us that they have decided to replace the Fixed 
Asset Inventory System, and showed us a plan for converting to the replacement system by April 30, 
1999. 



UAO officials stated that they had reviewed all of the component programs and have 
already made significant changes to its systems during 1997. Further corrective efforts were on hold 
until staff had finished the year-end processes for fiscal year 1997-98, scheduled for completion by the 
end of July 1998. They said they expected to intensify their efforts after this time, and have targeted 
the end of calendar year 1998 for completion of their portion of the agency-wide project. While there 
is no formal Year 2000 work plan, the UAO maintains a list of outstanding issues and is using its 
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regular project management system to track its efforts. We found that no distinct Year 2000 testing 
plan has been developed that would ensure that all Year 2000 risks are tested, despite the confidence 
of UAO officials that all necessary testing will be accomplished by the end of 1998. We believe a 
written test plan is essential to assure CUNY that all appropriate risks will have been tested by the 
target date of December 31, 1998. 

Response of UAO Officials to Audit : UAO officials replied that now that fiscal year 1997-98 is closed, 
UAO’s efforts in bringing all systems to Year 2000-compliance have intensified dramatically. They 
add that test files have been established for the Accounting and the Budget/Payroll Systems. They 
report that the Student Financial Aid System master file is compliant. 

• UAPC Data Center 

The University Application Processing Center (UAPC) is located at Kingsborough 
Community College. Its staff advised us that UAPC started in January 1997 to implement strategies 
to ensure the proper operation of its application systems into and past the Year 2000. Although neither 
a formal awareness program was initiated nor a formal inventory completed, UAPC’s critical 
applications have been identified and have either been corrected or are scheduled for corrective action 
to be taken in 1998. Work remains to be done on four critical applications: the Student Automated 
Record Keeping (SARK), Direct Loan, CUNY Admissions, and the Tuition Assistance Program 
(TAP) Certification systems. Although no formal project plans have been made for the completion 
of work on these systems, benchmark dates have been set. This effort is being viewed as regular 
program maintenance and there is no formal documentation for testing in terms of Year 2000- 
compliance requirements. Staff at UAPC do not foresee that the Year 2000 problem will cause major 
disruptions in their operations. 

The UAPC data center director indicated to us that the major system at risk is SARK, 
which is presently used by the New York City Board of Education for all students under its Division 
of High Schools. SARK tracks and/or reports attendance, transfers, transcripts, grades, postcard 
mailings, and test scoring, among other items. It has been operational since 1968, and the Board of 
Education has been using it under a contract between the Board of Education and CUNY. The current 
contract expires in June 2000 and it is not clear whether the Board of Education will want to renew 
the contract. According to UAPC officials, the Board of Education is currently testing a new PC-based 
system to fulfill SARK processing. Therefore, it is not certain whether the Board of Education will 
continue to require SARK in the Year 2000 and beyond. However, officials indicated that no one from 
the Board of Education had formally contacted UAPC on this matter. In addition, the contract does 
not include Year 2000 language. Given these conditions, UAPC does not believe it is responsible for 
correcting SARK. We believe that it is incumbent on CUNY (as well as the Board of Education) to 
reach agreement as soon as possible on the need to make SARK Year 2000-compliant. After our audit 
field work was completed, UAPC officials reported to us that they plan to keep SARK functional 
through June 30, 2000. Full SARK compliance with Year 2000 requirements is expected by July 

1999. 

Response of UAPC Officials to Audit : UAPC officials indicate that they have met with the Board of 
Education to reach an understanding about SARK. UAPC plans to keep SARK functional to June 30, 

2000. Officials now state that no commitment has been reached for beyond June 2000. 
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The CUNY Admissions System, which processes applications for first-time 
undergraduates and transfer students, was expected to be corrected by May 31, 1998. SARK 
interfaces with this system as most incoming CUNY freshman come from the Board of Education's 
high schools. UAPC officials indicated they will need to window the dates from the interface files 
that transmit data from SARK concerning Board of Education high school graduates who register at 
CUNY. (Windowing involves the use of program logic to determine whether a two-digit year is in 
the 1900s or the 2000s and does not involve conversion of data by expanding to a four-digit year field.) 

Response of UAPC Officials to Audit : Officials indicate that all programs involved in the 
undergraduate and advanced-standing admission systems have been modified and tested. They indicate 
that windowing logic has been provided for files from SARK. 

Officials of UAPC told us that New York State Higher Education Services Corporation 
(HESC) was originally slated to replace the State’s TAP Certification process with a new system in 
the summer of 1998. UAPC officials maintained that the needs of their TAP Certification System 
could not be determined until the details of the State’s new process became available. After our audit 
field work was completed, UAPC officials informed us that HESC will not be providing a new system. 
Accordingly, UAPC should proceed with its plans for correcting its TAP Certification System. 

The Direct Loan Program System is redeveloped for each academic year. Therefore, 
the correction for this application is to occur during its normal cyclical development and 
implementation process in the 1998-99 academic year. 

Response of UAPC Officials to Audit : UAPC officials replied that the TAP Certification System and 
the Direct Loan Program System are Year 2000-compliant. 

At the time of our field work, UAPC officials had not fully considered the Year 2000 
reliability of products licensed or purchased from outside sources. However, UAPC officials have 
started contacting outside vendors and are obtaining written documentation of Year 2000 compliance. 
We were also informed that the UAPC mainframe and operating systems were already Year 2000- 
compliant. However, we were informed that, if the New York City Board of Education’s SARK 
application contract is renewed, the UAPC mainframe may need to be upgraded. UAPC officials also 
informed us that they had not yet tested their PCs for Year 2000-compliance. 

UAPC officials also have informed us that they are currently developing a plan for 
testing their mainframe operating system, vendor-supplied software, as well as applications that were 
developed in-house. They maintained that if their mainframe is upgraded they will assure that it is 
also Year 2000-compliant. UAPC officials added that all of their own systems are expected to be Year 
20Q0-compliant by the end of 1998. 

Since our field work ended, UAPC officials advised us that they have contacted vendors 
of all of the software installed on their mainframe regarding Year 2000-comp liance. They have written 
guarantees of full compliance for all products except one, for which delivery of a fully-compliant 
version had been promised for June 1998. Three products for which a compliant version had not been 
installed were expected to be installed during the summer of 1998. UAPC officials expected compliant 
versions of all of the products they used to be in production by September 1998. They have also 




10 



-9- 



completed an inventory of PCs to determine software and hardware compliance and have collected PC 
software-compliance information from vendors. They expect to complete needed PC upgrades to 
achieve Year 2000 compliance by the end of 1998. 

Response of UAPC Officials to Audit : UAPC officials report that progress continues to be made with 
the mainframe operating system and vendor-supplied software. They added that PCs will be compliant 
by March 1999. 



• Colleges 

We met with officials at four colleges - City College of New York (CCNY), Hostos 
Community College, Kingsboro Community College, and the Borough of Manhattan Community 
College - to determine their awareness of the Year 2000 problem and the status of their plans for 
corrective actions in the areas of mainframe applications, PCs, and ancillary equipment. Officials at 
all four colleges informed us that they had received no guidance from CUNY’s central office, except 
for a policy from Legal Counsel that provides and requests the use of Year 2000 language in 
technology bids and contracts. We found that none of the four colleges had initiated a Year 2000 
awareness program, taken an application inventory, or established a Year 2000 work plan. 

Generally, officials were grateful that we met with them and brought the Year 2000 
problem to their attention. Some officials were not aware that ancillary equipment was also at risk. 
The ancillary systems that could be at risk at the colleges include security systems, fire alarms, 
heating -ventilation-air conditioning systems, energy conservation systems, elevators, time clocks, 
telecommunication systems, lab equipment, and in-house calendars. All of the college officials with 
whom we met appeared to want and needed guidance and direction to assure that their systems will be 
Year 2000-compliant. They all indicated that they would establish a project group and start to develop 
an inventory of systems and assess risks. 

CCNY has not migrated its student systems to the CIS central office mainframe. The 
college maintains a Student Information and Tracking System on its own mainframe that was developed 
in the late 1960s and is not Year 2000-compliant: A new Year 2000-compliant system utilizing Oracle 
database and Oracle tools has been under development for the past five years with a Federal grant. 
However, there is no assurance that the grant, already on extension, will be extended further and that 
the system will be implemented in time. CCNY officials indicated that, as a last resort, they would 
migrate to the CIS data center. 

After our visit, CCNY officials informed us they had initiated a three-phase plan for 
the inventory and testing of hardware and software, including all computer systems, network devices, 
printers, operating systems, and applications. The report of these findings will include estimates for 
any necessary upgrades and a list of priorities for solving the problem. The most time-consuming and 
difficult work will be the testing and evaluation of the in-house applications due to their complexity 
and size. At the time of our audit, officials said that when phase three finishes in May 1998, they can 
estimate the time and cost to fix CCNY’s Year 2000 problems. 
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Hostos Community College officials informed us that they maintain their own 
Registration and Transcript System, which they stated is semester-driven and does not appear at risk. 
However, the Immunization Tracking System and an environment conservation system that issues 
reports have been identified as at risk, and officials said that both of them must be evaluated. The 
Dean of Administration told us that a report related to Hostos Community College Year 2000 efforts 
was being prepared for the next Administrative Council meeting. 

Officials at Kingsboro Community College indicated that they were not concerned with 
their PC and software situation. They expressed the belief it would not prevent them from fulfilling 
their critical mission of providing education. However, their mainframe operating system is not Year 
2000-compliant. In addition, the Facilities Department was not aware that the college’s critical 
ancillary equipment and systems might fail. We were informed that the identification of systems at risk 
would begin, and that vendors would be contacted to obtain written certification of Year 2000- 
compliance. In addition, as a result of our visit, the Director of Computer Services sent out a memo 
to all faculty and staff making them aware of the Year 2000 problem. The Director requested that all 
systems/applications be reviewed and that all software packages currently in use be identified in writing 
for his office so that he could develop a plan for Year 2000-compliance. 

The Borough of Manhattan Community College (BMCC) officials informed us that a 
plan for code changes had been developed and that programs that need changes had been identified. 
However, the plan was not documented. In addition, two staff members are being sent to a Year 2000 
training program. 

Response of College Officials to Audit : All four colleges we visited responded with documentation 
pertaining to their Year 2000 corrective efforts. 

Recommendations 

1 . Be prepared to take a more control-oriemed approach should agency-wide project efforts under 
the facilitative approach not show sufficient progress. 

2. Continue with efforts to establish a comprehensive systems inventory and to provide 
comprehensive planning, budgeting, system testing, legal office involvement, and user 
awareness in support of the agency -wide Year 2000 project. 

3. Establish an overall work plan, systems inventory, and written testing procedures in support 
of CIS, UAPC, and UAO Year 2000 efforts. 

4. Determine the New York City Board of Education ’s plans regarding the future of SARK and 
consider them in assigning priority to Year 2000 corrections in this application. Make the 
necessary modifications that will make the Admission System interface with SARK compliant. 

5. Continue with plans for correcting the TAP Certification System operated at UAPC. 
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6. Use the Task Force and the Awareness Program to increase support and provide direction to 

the college campuses in their efforts to correct Year 2000 problems. 

7. Develop contingency plans for performing important services and functions that would be 

interrupted if systems are not year 2000-compliant. 

A draft copy of this report was provided to CUNY officials for their review and comment. 
Their comments were considered in the preparation of this report and are included as Appendix A. 

CUNY officials replied that the University shares our view that the Year 2000 problem is a 
major challenge facing government organizations and that a unified effort by the University and its 
colleges is needed to assure progress in this area. CUNY officials express concern that our report does 
not fully reflect the progress of the University toward Year 2000 system compliance. Accordingly the 
CUNY response provides information reflecting the current status of the University’s efforts. The 
response includes comments regarding Year 2000 plans, accomplishments and status as provided by 
officials of CIS, UAPC, UAO and the four colleges that are cited in our report. 

CUNY officials generally do not provide a specific response to each of our recommendations. 
With respect to recommendation number 7, officials do state that the University will work with KPMG 
Peat Marwick to ensure that all mission-critical systems are ready for the Year 2000 and where 
appropriate, take necessary remediation activities (including development of any contingency plans) 
to safeguard continued delivery of services. 

Within 90 days after the final release of this report, as required by Section 170 of the Executive 
Law, the Chancellor of the City University of New York shall report to the Governor, the State 
Comptroller and the leaders of the Legislature and fiscal committees, advising what steps were taken 
to implement the recommendations contained herein, and where recommendations were not 
implemented, the reasons therefor. 

Major contributors to this report were Robert Mehrhoff, Richard Perreault, and Jorge 
Vazquez. 

We wish to thank the management and staff at the City University of New York for the 
courtesies and cooperation extended to our auditors during this audit. 



Very truly yours, 




Jerry Barber 
Audit Director 



cc: Robert L. King 



Louis Chiacchere 
Richard F. Rothbard 
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The City University of New York 







OFFICE OF INTERNAL A UDIT 
535 East 80th Street, New York, NY 10021 
Voice: (212) 794-5421 Fax: (212) 794 5696 
e-mail: ljcbh@cunyvm.cuny.edu 



October 14, 1998 



Mr. Jerry Barber 
Audit Director 

Office of the State Comptroller 
A.E. Smith State Office Building 
Albany, New York 12236 

Dear Mr. Barber: 

I write on behalf of Interim Chancellor Christoph Kimmich in response to 
your request for comments regarding your draft report (97-N-13) concerning the 
actions taken by The City University of New York to address the Year 2000 (Y2K) 
challenge. The University shares your view that the Y2K problem is a major 
challenge facing government organizations and that a unified effort by the 
University and its colleges is needed to assure continued progress in this area. 

However, I am concerned that the report does not fully reflect the true 
progress of the University toward Y2K systems compliance. As your draft report 
indicates, the University has already taken action to prepare its major University- 
wide systems for Y2K compliance. The Y2K Task Force has become an 
important focal point for developing a coordinated approach in assuring that the 
colleges stay on track in achieving Y2K readiness. 

The comments, which follow, provide an overview of the University's 
efforts in achieving Y2K compliance. In addition, responses to the draft report’s 
specific recommendations were provided by the Office of Computing and 
Information Services and the University Application Processing Center (see 
Attachments I and II). The University Accounting Office also responded with an 
update regarding its continued progress in ensuring Y2K compliance (see 
Attachment III). 



The University and its colleges are aware of the Y2K problem and its 
potential impact on our operations. The University and its colleges are taking 
steps to identify and address any critical systems at risk, and to ensure 
compliance with system requirements for year 2000. 



Overview 
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The University has already taken action to prepare its major University- 
wide systems for Y2K compliance. The University-wide systems are supported 
centrally by the University Accounting Office, the Office of Computing and 
Information Services and the University Application Processing Center. These 
operating units have developed plans and are currently implementing strategies 
to ensure proper operations of their systems into and past the year 2000. These 
strategies include analyzing and modifying programs and systems developed in- 
house, and resolving data exchange issues and interagency concerns. In 
addition, the University Contracting Office in conjunction with the Office of Legal 
Affairs is addressing legal issues as they arise and providing the colleges 
additional procurement guidelines such as appropriate warranty language for 
procuring Y2K compliant products. 

The University has created a Y2K Task Force comprised of 
representatives of each senior and community college, and Central Office 
operations. The Task Force was formed for the purpose of assembling materials 
that assist central and college departments in managing the task of assessing 
the need for changes and then implementing required changes for each of their 
systems. The Task Force serves as a catalyst, facilitator and coordinator in 
assisting colleges on Y2K issues ranging from site licenses to wide and local 
area networks, and mainframe operating systems and PC hardware. A CUNY 
Y2K website provides timely responses to college inquires on a variety of Y2K 
problems such as testing PCs for problems related to dates stored in the 
underlying system functions (the Basic Input Output System, or BIOS). A PC tool 
kit is available on the website for downloading by the colleges. The University 
has raised awareness of the Y2K problem through the meetings of this Task 
Force, providing management and technical information through issuance of a 
newsletter and advisory memorandum, maintaining the CUNY Y2K Website and 
making presentations before the University's Administrative Council attended by 
college senior administrators and Central Office officials. 

The colleges are assessing their own operating systems and preparing 
Y2K project plans indicating their priority compliance strategies. The strategies 
include taking inventory; setting priorities for critical equipment and systems; and 
testing of any modified devices that address Y2K problems. These plans are 
being provided to the Task Force. Synopses of the plans submitted by the four 
colleges that were visited as part of your review are contained in Attachment IV. 

In conjunction with the Task Force, the University’s Department of Design, 
Construction and Management is coordinating with the colleges the identification 
of embedded systems that are date-sensitive such as security systems, 
elevators, HVAC and fire alarm systems. The Dormitory Authority of the State of 
New York (DASNY) is funding a project to assess the potential building 
equipment/systems operational problems associated with use of embedded 
systems on college campuses. The project will entail document research, a 
detailed survey to collect data and inventory existing equipment/systems, 
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evaluation of existing systems to identify equipment/systems, evaluation of 
existing systems to identify equipment/systems subject to possible operational 
time change problems, documentation of manufacturers' input concerning 
compliance, evaluation of the relative impact that existing deficiencies have on 
facility utilization with the formulation of specific solutions and recommendations, 
formulation of cost estimates, creation of databases and college reports which 
contain information concerning existing campus/building systems. 

With respect to the draft report’s recommendation number 7, an 
assessment of Y2K computer issues is also currently being undertaken by KPMG 
Peat Marwick as part of its audit of the University's consolidated financial 
statements. The results of this assessment will be shared with University 
management for the purposes of evaluating our Y2K preparedness to-date and 
making recommendations for consideration by the University. The University will 
work with KPMG Peat Marwick to ensure that all mission-critical systems are 
ready for the year 2000 and where appropriate, take the necessary remediation 
activities (including development of any contingency plans) to safeguard 
continued delivery of our services. 

Thank you for offering the University the opportunity to comment on your 
draft report. We share your view that the year 2000 is a priority and we will 
continue to cooperate with you in the months ahead to effectively meet this 
challenge. 



Louis Chiacchere 

c: Interim Chancellor Christoph M. Kimmich 

Interim Deputy Chancellor Patricia Hassett 
Vice Chancellor Richard F. Rothbard 
Dean Michael Ribaudo 
Mr. Les Jacobs 
Mr. Anthony Hladek, Jr. 

Mr. Victor Viggiano 
Ms. Helen Woo 
Ms. Shelley Reed 
Mr. Jack Chen 
Ms. Anne Reinhard 
Mr. Charles Foster 
Ms. Deirdre A. Taylor 



Sincerely, 




Attachment I 



The City University of New York 




Vice Chancellor for Budget , Finance , and Information Services 
Office of Campus Services 

555 West 57th Street , 1 6th floor , New AO 7 10019 

(212) 541-0938 Fax: (212) 541-0379 



October 8, 1998 

To: Lou Chiacchere, Office of Internal Audit 

From: L. Anne Reinhard, CIS Office of Campus Services 

RE: Responses to Auditor’s Recommendations, items 2, 3, and 6 



The second Task Force meeting, scheduled for 10/20/98, is a continuation of ongoing Listserv 
discussions revolving around Y2K campus issues and concerns. 

We have provided testing procedures, sample spreadsheets, and organized relevant vendor web 
sites on the CUNY web site: http://www.cuny.edu/y2k 

The following inventories have been completed: (or 90%) 

PC’s BIOS .... testing completed 

OS 70% compliant, remainder being upgraded 
Application Software... currently being tested by departments 
Mainframe Hardware ... complete 

Mainframe OS .... in progress (completion expected Spring 99) 

Mainframe Applications ... all critical applications completed 96/97. Final 

testing awaits mainframe test partition; expected to complete by spring 1999. 

WAN inventories completed, upgrades in progress 

LAN and IVR inventories completed, upgrades in progress 

Upgrades have either been purchased or budgeting is in place. 



Enc. Task Force Meeting Agenda 
Selected Web Documents 
Inventories 
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CUNY Y2K Task Force Meeting 

October 20, 1998, 10:00am, Seminar Room 



Auditing issues David Rankert 

• Auditor's status report 

• Project Plans 

Mainframe update Jack Chen 

• Test environment schedule 

- VM (CMS 14) 

- MVS (OS 390) 

PC testing/LAN related issues Steve Yoman 

• Commercial testing software for PCs 

• College experiences 

• Need for subcommittee(s) involvement? 

Wide Area Network (WAN) Anil Khullar 

• Cost update 

Interactive Voice Registration (IVR) Dave Kopel 

•Application issues 

Embedded systems Charles Collins 

Library Pat Young 

• Areas of responsibility 

- Central Office 

- Campus 

Open Discussion 

NB: Daphna Mitchell , Office of General Counsel, will be available at the meeting for legal 
questions you may have. 
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CUNY/CIS Y2K Toolkit for PC Inventory 

Year 2000 Hardware Procedures for Intel and Intel-compatible Computers 

At CUNY/CIS we are incorporating a re-inventory of our personal computers with regular problem 
visits and maintenance upgrades, i.e., technicians will bring inventory sheets with them on all 
desktop visits. 

Before you begin: 

1. Prepare a bootable DOS diskette. 

2. Copy Year 2000 testing program(s) to diskette (see information about finding these below). 

3. Establish consistent abbreviations and other conventions for use on Year 2QQQ PC/LAN 
Inventory List (MS Excel format - 41KB) to be used during data collection. 




If you do not use MS Excel, you may use a Viewer to open and print this file. 

This file should be printed landscape on legal size paper. 

This file has been disinfected with the latest virus definitions (Virex and F-PROT) as of 
07/23/98. 

The Year 2000 Diskette: 

Create a bootable DOS diskette. Copy a Year 2000 testing program to the diskette. Two programs for 
use in testing computer BIOS for year 2000 compliance were recommended to us by the auditors: 
test2QQ0.exe and 20Q0.exe. You may use either program. Links to these programs are also available 
through CUNY's Year 2000 website at: http: / Zwww.cuny.edu/y2k . 

Developing an Action Plan: 

If we already had a complete and reliable online PC inventory, we could determine a ’’BIOS fix" 
strategy in advance of the desktop visits. As we do not have such an online inventory, the question 
of which BIOS fix to apply is not an issue at this stage. An advantage of this approach, as opposed to 
the fix-as-you-go strategy, is that it removes the decision (of which level of fix to use) from the 
technician and places it back with management. 

There are several levels of fix that can be used for machines that are not Year 2000 compliant, but 
can be fixed or upgraded: replace ROM chip, flash update ROM chip, or various software fixes. 

After 20-30% of the inventory is completed, the results will be treated as a statistical sample that 
generates a treatment profile for the most common types of machines. The remaining 70-80% of 
equipment will have the appropriate BIOS fix predetermined at the time the technician makes the 
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desktop visit. 

1. Inventory 20-30% of PC equipment without performing BIOS fixes 

2. Generate from above sample a diagnostic profile of the predominant machine types that are 
upgradeable 

3. Download from vendor web sites, or purchase, the optimal BIOS fixes 

4. Complete the remaining inventory survey and apply appropriate BIOS fixes during desktop 
visit 

Data Collection and BIOS testing: 

1. Before testing a particular PC, fill in all inventory information, including OS and memory. 

2. With your bootable DOS diskette in the 'A: drive 7 , power on the computer. 

3. Run the Year 2000 test program(s) and indicate the results on the Year 2000 PC/LAN 
Inventory List: pass, fail or partial, including BIOS version date. 

4. Affix colored sticker (pass=green, fail=red, partial=yellovv) to computer and write BIOS 
version date on sticker. 

Retur n to to p Of Ffl gg 
Retur ri-taCU NY Y 2 K H omeJEage 

This Y2K Site was developed at The City University of New York by CUNY/CIS. 

Please send any comments to the CUNY Year 2000 Task Force . 
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rrUp://www.cuny.edu/y2kyiinks.h1ml# vendor 



Year 2000 (Y2K) Resources - Links 

o 

General Information 

• George Girod's annotated bookmarks of Y2K resources, including: 

Training /Education /Awareness, Standards, governmental agencies, information, software 
engineering, product compliance, project management, diagnostics/fixes, etc. 

• Detailed discussion of Compliance Issues from the MITRE Corporation 

• CPSR - Computer Professionals for Social Responsibility /Y2K Working Group 

• Extensive Cvberlaw topics and resources for the Year 2000 

• Mother of all Year 2000 CY2K) Link Centers has over 2600 links in 24 categories 

• University of Texas departmental action plan for Year 2QQil 

• Yahoo’s list of Year 2000 links 

• The Year 2000 Information Center and it s "no frames 1 ’ version list information and many 
vendor links 

Re tu rn to top of pa ge 

Return to CUNY Y2K Home Page 



Government Information 

• New York State Government - Year 2000 Coordination and Resources 

• The Federal Government's Year 2000 "Home Pag e 1 ’ is sponsored by the General Services 
Administration and the Chief Information Officers (CIO) Council Subcommittee on Year 
2000 

• The Federal Government's General Services Administration (GSA) has information 
regarding Year 2000 compliance and telecommunications products and services, including 
vendor links . 

Return to top of pag e 

Return to CUNY Y2K Home Page 



Vendor Information 

• Hardware Vendors 

O Apple - Macintosh hardware and operating systems have always been able to handle 
dates past the year 2000. Application software that uses the Mac OS Toolbox correctly 
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will also manage the transition to the next century. Details on what to look for at this 
site. 

O Award Software - BIOS manufacturer 

□ Year 2000 Statements: Year 2000 Compliance 

□ Year 2000 Evaluation tools: Survive 2000 - also lists information about why the 
NSTL program 2000.exe may give false readings for an Award BIOS. 

o C ompaq 

□ Year 2000 Statements: Warranty clarification 

□ Year 2000 Evaluation tools: Testing methodologies 

□ Year 2000 Fixes: Compaq Solution to Hardware and Firmware Issues 

□ Product Listing: Product Tables 

O Cisco - Detailed table listing of hardware and software and their respective. 

compliance /noncompliance. Also details what items will be tested and upgraded. 

O DEC - Digital Equipment Corporation 

□ Year 2000 Statements: Di gital's Hardware_and Software Year 2000 Warranty - 
Overview 

□ Product Listing: Product Readiness 

o Dell 

□ Year 2000 Statements: Y ear 2 QQQ Statement Qf Co mpl ia nce on Dell Hardware 
Products 

□ Year 2000 Evaluation tools: Tools for evaluating product readiness. 

□ Year 2000 Fixes: Software patch for machines not already compliant 

□ Product Listing: Year 200Q Product Readiness Status 

O Gateway 

□ Year 2000 Statements: Gateway's Position on Year 2000. including status of 
their machines and how to reset the clock on older machines. 

O Hewlett Packard (HP) 

□ Year 2000 Statements: Complianc^JDefirdtion 

□ Product Listing: PmdurLEeadiness^Status 

O IBM lists general information at their Year 2000 Home Pag e, in their FAQ and at their 
technical support center. 

IBM PCs - this site shows you how to evaluate your IBM PCs and their readiness for 
Year 2000. It includes solutions for machines going back to the PC/AT. 

□ Year 2000 Statements: IBM's Positions on Year 2000 

□ Year 2000 Evaluation tools: IBM PC Evaluation Tools and Year 2000 Product 
Readiness Database . 



o Micron 

□ Year 2000 Statements: Compliance Statement 

□ Year 2000 Evaluation tools: Testing. Updating and Upgrading 

□ Product Listing: Product Compliance 
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O NEC 

□ Year 2000 Statements: NEC CSD Definition of Year 2000 Compliance 

□ Year 2000 Evaluation tools: Year 2000 Test Utility 

□ Product Listing: NEC Syste ms and Servers 

o Sun 

□ Year 2000 Statements: Year 2000 Frequently Asked Questions 

□ Year 2000 Fixes: See "Product Listing" for pointers to Year 2000 

□ Product Listing: Year 2000 Compliant Product List 

O Timeplex 

• Software Vendors 

PLEASE NOTE : 

YOU ARE REMINDED THAT YOU DO NOT OWN ANY SOFTWARE 

THE VENDOR/COPYRIGHT OWNER HAS GRANTED CUNY/YOU A LIMITED LICENSE TO USE 
THE SOFTWARE IN PARTICULAR WAYS 

IN ALMOST EVERY CASE, CUNY/YOU HAVE NOT BEEN GIVEN THE RIGHT TO CHANGE CODE 



O Borland (which has been renamed to Inprise) - This site has a table listing all current 
and past Inprise products. Any Year 2000 issues or database date ranges are also listed. 
Hyperlinks point to additional product information. 

O Claris - Filemaker Pro 2.1 and older versions allow entry and manipulation of 2-digit 
and 4-digit years and always assume 2-digit years refer to the 20th century. Filemaker 
Pro versions 3 and later use certain rules to interpret 2-digit dates. Details at this site. 

O Corel - Listings of all products and the upper date limits, for 2-digit or 4-digit dates, are 
on their product listing page. 

O IBM Year 2000 Home Page 

□ Year 2000 FAQ 

O Year 2000 Technical Support Center 

O Product Readiness 

o Macromedia 

O Microsoft 

O Netscape 

O Novell 

□ Year 2000 Status of Novell Products 

□ Year 2000 updates 

O Oracle 
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O S AS System Year 20QOHome Pag e 

□ Compliance levels for specific releases of the SAS System and_specific_SAS 
products 

□ YFARCUTOFF= option which ensures that dates displayed with 2 digits are 
calculated correctly 

O SPSS and the Year 2000 

□ Technical Support and SPSS Inc.'s corporate readiness for the Year 2000 

o 

Return to top of pag e 

Return to CUNY Y2K Home Page 



Testing PC's for Year 2000 Compliance 

Many PCs are not Year 2000 compliant; some can be fixed, others cannot be fixed. Below are pointers 
to sites that offer testing programs: 

• Ri ghTime's Y2K testing software (test2000.exe) and information . 

• N STL's YMARK2000 utility includes the 20QQ.exe program for testing compliance on some 
machines. A FAQ will answer most of your questions. (However, see caveat that this 
program may give false readings on machines with certain AwardBIOS source code.) 

Macintosh computers (hardware and operating system) are Year 2000 compliant according to Apple. 

Return to top oL p age 

R eturn tp C U NY Y2K Home P age 



This Y2K Site was developed at The City University of New York by CUNY /CIS. 
Please send any comments to the CUNY Year 2QQQ Task Force . 
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UNIVERSITY APPLICATION PROCESSING CENTER 

Box 350284 

Brooklyn , NY 11235 0005 



1998 October 8 



Mr. Lou Chiacchere 
Director of Internal Audit 
City University of New York 
535 E 80 Street, Room M-525 
New York, NY 



Re: State Comptroller's Draft Audit Report on CUNY Y2K Efforts 
Dear Mn^liacchere: 



We have reviewed the September 18, 1998 draft of the State Comptroller’s Office’s preliminary 
report on CUNY's year-2000 preparedness. 



UAPC has continued implementing the plans described in our letter of 1998 May 28. We expect 
that all systems developed in-house will be year-2000 compliant by the end of 1 998 with the exception 
of the SARK system. By this we mean that all systems will at least continue to correctly provide current 
functionality. In some cases, as noted, two-digit years may continue to be used, but they will produce 
correct results when sorted and compared. The status of the SARK system is discussed in detail below. 



I've attached an updated response indicating the current status of our year- 2000 plan as it affects 
the issues discussed in the section of the report about UAPC. 



Sincerely Yours, 

i 

Lester Jacobs 
Director 



O best copy available 
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- 1 - 

- “Work remains to be done on four critical applications: the Student Automated Record 
Keeping Keeping (SARK), Direct Loan, CUNY Admissions, and the Xuition Assistance Program 
(TAP) Certification systems." 

SARK still needs considerable work. The Direct Loan system is compliant. A compliant 
version of the CUNY Admissions system is ready for installation during 1998 October. The 
TAP and TAP Certification systems as they exist will work past 1999, but will require changes 
to conform to record-layout changes planned by the State Higher Education Services 
Corporation as part of its Y2K compliance modifications. 



- "The UAPC data center director indicated to us that the major system at risk is SARK,.... We 
believe that it is incumbent on CUNY (as well as the Board of Education) to reach agreement as 
soon as possible on the need to make SARK Year-2000 compliant. After our audit field work was 
completed, UAPC officials reported to us that they plan to keep SARK functional through June 
30, 2000." 

UAPC met with officials of the Board of Education on 1998 July 8. At that meeting we 
indicated that we expected to keep SARK operating with its present functionality through the 
end of the contract on 2000 June 30. “Present functionality" means that input and output files 
and reports will continue to use 2-digit years wherever they do so now, with "00” representing 
2000, etc. We indicated that in the absence of additional negotiated agreements, we did not 
intend to expand the fields that contain 2-digit years. 

We expect to achieve this extension of present functionality to 2000 June by the end of 1998. 
As we pointed out in the meeting, and as acknowledged by the Board in a memorandum 
summarizing the their understanding of the outcome of the meeting, these modifications will not 
enable the system to function properly beyond the end of the contract period because of a 
problem with term designations. As indicated in this memo, UAPC has made no commitment 
at this time to adjust the system to work beyond the end of the contract period. 



%2 - "Full SARK compliance with Year 2000 requirements is expected by July 1999." 

UAPC has made no commitment for Year 2000 compliance with regard to SARK beyond the 
one stated in the previous item. If time permits, we will analyze the requirements for extending 
the viability of the system beyond 2000 June during early 1999. 

<13 - "The CUNY Admissions System ... was expected to be corrected by May 31, 1998.” 

All programs involved in both the undergraduate and advanced-standing admission systems have 
been modified and tested. The advanced-standing system modifications are in production and 
the undergraduate system modifications will be installed during 1998 October. All internal and 
external date fields have been changed to include four-digit years except for files transmitted 
from the SARK system, for which windowing logic has been provided. 
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- 2 - 



H4 - ...UAPC officials informed us that HESC will not be providing a new [TAP Certification] 
system. Accordingly. UAPC should proceed with its plans for correcting its TAP Certification 
System." 

Our analysis of TAP Certification indicated that no changes were needed because UAPCs 
processing of this data did not involve any ordered comparison of date fields. The only year- 
2000 consideration involved in our data exchange with HESC was the need to truncate the 
newly-expanded four-digit year fields in our Financial Aid system to fit their record formats 
when transmitting data. 

On September 3, HESC notified its users that some time in 1 999 Spring, it will modify its record 
formats to include four-digit years. Since our process is already Y2K compliant, we will treat 
this change as an ordinary record format change rather than a year-2000 issue. Truncation on 
output will no longer be necessary. Any previously received data stored at UAPC will be 
converted to the new format, with “19" inserted in front of each year. This change affects TAP 
Financial Aid processing as well as TAP Certification. 

flS - “The Direct Loan System is redeveloped for each academic year. Therefore, the correction 
for this application is to occur during its normal cyclical development and implementation process 
in the 1988-99 academic year. 1 ' 

The 1998 Direct Loan System currently in production is totally year-2000 compliant, using four- 
digit years in internal and external data formats, in data-entry, display, and reporting. 

117 - UAPC officials also have informed us that they are currently developing a plan for testing 
their mainframe system, vendor-supplied software, as well as applications that were developed in- 
house." 



A compliant version of our security system was installed on our test system in late September. 
We expect to begin testing in 1998 October, starting with rollover and year- 2000 JPL tests of 
the bare operating system. Increasingly more inclusive tests will be scheduled during the Fall 
and Winter. 

V - “They maintained that if their mainframe is upgraded they will assure that it is also Year-2000 
compliant." 

A new mainframe processor is being installed over the Columbus Day weekend (10-10/10-12). 
IBM certifies that it is year-2000 compliant. 

f7 - "UAPC officials added that all of their own systems are expected to be Year-2000 compliant 
by the end of 1998, except for the TAP application." 

TAP and TAP Certification will be compliant (see <]|4 above). SARK is expected to be 
compliant only for use through the end of the contract period in 2000 June (see f2 above). 
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18 - "Since our field work ended, UAPC officials advised us that they have contacted vendors of 
all of the software installed on their mainframe regarding Year 2000 compliance. They have 
written guarantees of full compliance for all products except one, for which delivery of a fully- 
compliant version had been promised for June 1998. Three products for which a compliant 
version had not been installed were expected to be installed during the summer of 1998. UAPC 
officials expect compliant versions of all the products they use to be in production by September 
1998.” 



UAPC’s mainframe operating system and all vendor-supplied mainframe software currently in 
production have been certified by their vendors as year-2000 compliant with the following 
exceptions: 

• CA-Top Secret (security system). Although CAs documentation had stated that 
Top Secret was compliant, closer questioning revealed that CA was referring to 
future release 5.0, not the then-current Version 4.4. UAPC is still running 
Version 4.4 in production at UAPC, but is testing Version 5.0. Version 5.0 will 
be in production by the end of 1998. 

• Innovation Systems' FDR (backup, restore, archiving system). Innovation has 
not yet announced when a compliant version will be available. 

• Candle s Supersession (VTAM session manager) and Omegamon (performance 
monitor). Compliant versions became available in 1998 September, but have 
proved difficult to install. They are currently being tested and should be 
installed by the end of 1998. 

• ACS's WYLBUR (text editor and job-entry system). We have licensed access 
to the source code for this system and are running an extensively modified old 
version. We have certified this product as compliant by examining and 
repairing the source code as we would for a system written in-house. 

18 - "They have also completed an inventory of PCs to determine software and hardware 
compliance and have collected PC software- compliance information from vendors. They expect 
to complete needed PC upgrades to achieve Year 2000 compliance by the end of 1998." 

PCs will be compliant by 1999 March. 
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UNIVERSITY ACCOUNTING OFFICE 
555 West 57 Street, New York, N.Y. 10019 
(212) 397-5600 Fax (212) 397-5685 



October 14, 1998 



To: 



Lou Chittcchcr 




From: 



Tony Hladctf 



Subject: State Comptroller’s Year 2000 Audit 



Now that fiscal year 1997-98 is closed, UAO’s efforts in bringing all systems to Y2K compliance 
has intensified dramatically. The six most senior programmer/analysts, under the supervision of 
the Director of Systems, are spending all their time on the major Y2K issues. The remainder of 
the programming staff is working on the less critical Y2K issues. The uudit report indicates that 
a written test plan should be established. Please be advised that test files hove already been 
established for the Accounting System O' AS), and Budget/Payroll System (FIS). The Student 
Financial Aid System (SFA) master file is already Y2K compliant. 

The attached memo indicates the major tasks to be performed, time required and responsible 
personnel. 

Attachment 



u/:wcbh/wptioc^onyty20<W»ud.mem 
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UNIVERSITY ACCOUNTING OFFICE 
355 West 57 Street, New York, N Y. 10019 
(212) 397-5600 



October 7, 1998 

To: Helen Woo yiy 

From: Ray Tam 

Re: Yr 2000 Systems Test Plan and Time line 

Since completion of fiscal year-end 1998, wc arc currently devoting all our programming 
resources towards the year 2000 project. We are intensifying efforts in year 2000 modifications, 
testing, and implementation in all our systems (FAS, FIS, and SFA). Based on the December 3, 
1997 memo regarding Year 2000 Systems Concerns, 1 1 major tasks were identified which 
needed to be completed relating to the year 2000 problem. This memo will address those tasks 
and their current status as well as establish a test plan and Time line for their completion. 



FAS System: 

A set of test files (GL. SL, OC, Etc.) with fiscal year 00 have been established on the 
VSAM batch side for D06 daily batch update testing, and year-end testing, 'fhese files have also 
been loaded into IDMS for online screen testing. We have taken the latest month-end files and 
copied them over into the test environment changing the fiscal year to 00 for testing purposes 
Three programmer/analysts have been assigned to oversee the major functions of this system f«T 
year 2000 issues: 

Ycar-cnd testing simulating fiscal year-end 1999 rollover and D06 daily 
batch update testing, time required 1 month. 

Online F3x encumbrance screens, F27 journal entry screen, F28 accruals 
screen, and F37 suspense clearing screen testing to accept “H” for the state 
and “7” for the city for year 2000, time required 1 month. 

O'lPS interface between the slate **H M in first digit of PO to indicate year 
2000 and the city "?** for encumbrances and payments, time required 3 
weeks. 



John Velazquez 
Sheryl Mcsagno 

Allan Rocque 



FIS System: 

A set of files (PS, Summary, and Table) with fiscal year 00 have been established on the 
VSAM batch side for F1S004 daily batch update testing. These files have also been loaded into 
IDMS for online screen testing. Wc have taken the latest month-end files and copied them over 
into the test environment changing the fiscal year to 00 for testing purposes. Four 
programmer/analysts have been assigned to oversee the major functions of this system for year 
2000 issues: 

Russ Larsen FTS004 daily update testing fur year 2000, lime required 1 week. 

John Velazquez PAYSR State payroll year 2000 implementation, FIS payroll programs to 
be modified and implemented by December, time required 3 weeks. 
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Review and modification of all LIS online screens as needed for year 2000 
compliance, lime required I month. 

Allan Roeque City payroll changes for year 2000 as it pertains to FIS, time required 3 

weeks. 



SFA System: 

l*he SFA master file has been modified to accommodate multiple fiscal years including 
year 2000 processing. The maintenance cycle and the pay cycle programs will process year 
2000. These programs have been tested in simulations using live data (fiscal year 99 data 
replicated as fiscal year 00) and the results have been verified by the user. Furthermore, the 
online SFA screens have already also been tested for year 2000 compliancy In the area of Direct 
Loans work needs to be done as far as date checking for disbursements is concerned. Two 
programmcr/analysts have been assigned to make this year 2000 compliant: 

Russ Larsen SFA Direct Loan date checking for disbursements, time required 1 month. 

George Gliksman Direct Loan program series, review and modify for year 2000, time 

required 3 weeks. 



ALL Systems: 

Approximately 147 programs have to be reviewed and modified as needed for sort 
sequences and report headings as it pertains to year 2000 issues. The rest of the programming 
staff is responsible for reviewing and making appropriate changes, time required 2 lo 3 months. 
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THE CITY COLLEGE 
OF 

THE CITY UNIVERSITY OF NEW YORK 
CONVENT AVENUE AT 138th STREET 
NEW YORK, NEW YORK 10031 

Office of the (212) 650-6680 

Vice President for Fax (212)650-5068 

Finance & Management 



August 12, 1998 
TO: Lou Chiacchere 

FROM: Anne J, Ryan 

SUBJECT: Y2K Compliance Plan 



In reference to your memo of July 21”, 1998 a summary of our present Y2K effort is 
as follows: 

In phase 1, we have tested and inventoried the hardware in various departments. In 
addition, we have also inventoried all software applications in each system. To test 
the hardware, we have been using the latest version of the freeware test2000, and 
other manual procedures from the Y2K Consortium. When we encounter a 
computer with bios or internal clock problem, the year 2000 patch is applied. The 
computer is then re-tested to evaluate the effectiveness of the patch. 

In phase 2, we have tested and evaluated all the inventoried software applications. 
For commercial softw are applications, we have checked with the software 
manufacturers for Y2K readiness. For in-house software applications, we have 
reviewed each program module for Y2K compliance. 

In phase 3, we will be reporting our inventory, findings, an estimate for any 
necessary upgrades, and a list of priorities and possible solutions to bring readiness 
to all our major operations. 

In phase 4, we will be actively implementing various solutions to ensure Y2K 
compliance to all the computer systems and applications. This phase requires the 
replacement or upgrade to all antiquated hardware and software. Additional 
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programming may also be done for in-house applications. Each component will also 
be re-tested to ensure the proper execution and validity of any patches or upgrades 
upon completion. 

We are currently at the end of phase 3 and in the middle of phase 4. All our 
hardware and software applications have been tested. All components that need 
fixing have also been identified. More importantly, almost all of the outdated 
hardware components have been replaced or upgraded to meet the Y2K 
requirements. Many of the commercial applications have also been upgraded or 
patched as well. We are currently looking at possible solutions or alternatives for 
several of our in-house applications. A more thorough report will be available in 
September. 

I am also enclosing copy of letter sent to Charlie Collins on July 27°' pertaining to 
embedded systems compliance. 



Cc: Anne Reinhard 
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BMCC YEAR 2000 ACTION PLAN : 

A Steering Committee has been formed to coordinate the Year 2000 activities It is 
understood that the problem is not just a Computer Center problem, bu *at itw.ll 
involve cooperation and support of many of the Departments m the College. Each 
member of the Steering Committee is amember of an af ^ d ^ wl1 ' 

coordinate the activities of that Department m terms of the \ ear 2000 Problem. 



The BMCC Action Plan consists of 4 phases as described below. It is clear that individual 
Systems may be at different stages during the process of remediation. The pnonty of the 
College wiUbe to identify, fix and test the Student based mission Critical Systems before 

the others. 



1. Inventory Phase: Identify all elements, Computer related or otherwise, that may get 
affected. The following is a list of the major items in BMCC - 



- COMPUTER HARDWARE 

- SERVERS and WORKSTATIONS 

- DESKTOP Machines 

- NETWORKS (LAN) 

- COMMUNICATION DEVICES 
-ROUTERS 

-HUBS 

- SWITCHES, ETC. 

- VENDOR SUPPLIED COMPLETE SYSTEMS 

- PHOTO ID SYSTEM 

- COOP ED REGISTRATION SYSTEM 

- GRADE & TEST SCANNERS 
-OTHERS 



- COMPUTER SOFTWARE 

- VM(TIF) - Admin. Comp. 

- MVS (COBOL + MARK4) Admin. Comp. 

- ACADEMIC Comp. Software 

-network 

- VENDOR SUPPLIED 

-BIOS 

- OPERATING SYSTEMS 

- SOLARIS & AIX 

- WINDOWSCAll Versions) 

- OS2 

- NOTES 



A-32 

o 

ERIC 



56 



T 



- OTHER EQUIPMENT 

- PHONE SYSTEMS 

- FAX & COPIERS 

- MEDIA CENTER FACILITIES 

- FACILITIES 

- ELEVATORS & ESCALATORS 

- HEATING & A/C 

- SECURITY SYSTEMS 

- FIRE ALARMS 

- BUILDING AUTOMATED SYSTEMS (POWER) 

2. Assessment Phase: The above items will be investigated as to whether they should be 
retired, replaced, fixed or made compliant by either BMCC or by the Vendors 
themselves. 

3. Remediation Phase: Fix the problem, or receive documentation from Vendor that 
Software/Hardware is compliant. 

4. Testing- 

- Testing of Each individual element. Hardware or Software 

- Integrated Testing of Complete Systems. 

Testing of mission Critical Complete Systems using advanced Clock. 

5. Certification by User or other Audit sources. 
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Kingsborough Community College 
2001 Oriental Boulevard 
Brooklyn, New York 11235 



Interoffice Memo 

Date: August 18, 1998 

To: David Rankert 

From: Bill Correnti 

Subject: Y2K Project Plan 



This is a copy of the letter that was E-mailed to me from Jim Anastasio. 
Subject: Y2K Project Plan 



Create a committee representing all members of the campus that must work with their 
constituents to inform and address the issue. The members of the committee that is currently 
defined are: 

Jim Anastasio — Y2K Local Coordinator 
Mike Keany — Telecommunications 
Dave Berger - Computer and Network Systems 
Marc Wiskoff — Academic Computing 
Christine Beckner - Continuing Education 
Bill Correnti — Business Office 

Begin to analyze what the effort is to review each station/system/component and request 
information from the community as to what they are utilizing. Expect to begin the station by 
station analysis of administrative and student lab machines over the summer to determine the 
status of compliancy. The student labs and most administrative offices have been surveyed for 
hardware compliance. We expect to complete this survey by the end of September 98 We plan 
on reviewing the academic offices during the Fall 98 semester. Create and distribute a 
questionaire to gather information from the campus community as to current and future 
hardware/software needs and how this effects Y2K compliancy. 

If you have any questions, please do not hesitate to contact me at (718) 368-5125. 



Ti/42computer/Y2K£mail,a 
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